plugin development - wp_verify_nonce is always false even when the nonces are identical

admin管理员组

文章数量:1122832

In a plugin i create a nonce with a time limit of 15 minutes:

function noncelife(){ return 900; }
add_action( 'run_custom_nonce_value', 'custom_nonce_value' );
    function custom_nonce_value(){
    add_filter( 'nonce_life', 'noncelife' );
    $created_nonce = wp_create_nonce('timform_nonce');
    remove_filter( 'nonce_life', 'noncelife' );

    return $created_nonce;
    }

With wp_localize_script i send the nonce to a jquery file enqueued in the plugin:

wp_localize_script( 'timcontact', 'ctfprocessajax', array('ajaxurl' => admin_url('admin-ajax.php'),
                                                      'formnonce' => custom_nonce_value() ) );

The ajax function in my jquery file sends all data via admin-ajax.php with the appropriate action name to wp_process_timform.php that contains the send e-mail function.

add_action( 'wp_ajax_toaformsendmail', 'timform_sendmail' );
add_action( 'wp_ajax_nopriv_toaformsendmail', 'timform_sendmail' );

function timform_sendmail() {
    if ($_SERVER["REQUEST_METHOD"] == "POST") {
        if (isset($_POST['nonce']) && !empty($_POST['nonce'])){
           $nonce = $_POST['nonce'];
           } else {
           $nonce = ''; 
           }

    if(! wp_verify_nonce( $nonce, 'timform_nonce' )){ //always false
       echo $nonce; //is identical but does not validate
       die( 'Security check' );
       } else {
       // Send the email.
    if (wp_mail($recipient, $subject, $message_send, $headers)) {
        // Set a 200 (okay) response code.
        http_response_code(200);
        echo "<p class=\"timform-okmessage\">Thanks etc.</p>";
    } else {
           // Set a 500 (internal server error) response code.
           http_response_code(500);
           echo "Error";
        }
        die();
        }
    }
}

The function works perfect without the wp_verify_nonce condition, but with wp_verify_nonce the condition always returns false. Why is this not validating when the nonces are identical? Is wp_verify_nonce not reachable via a plugin?

In a plugin i create a nonce with a time limit of 15 minutes:

function noncelife(){ return 900; }
add_action( 'run_custom_nonce_value', 'custom_nonce_value' );
    function custom_nonce_value(){
    add_filter( 'nonce_life', 'noncelife' );
    $created_nonce = wp_create_nonce('timform_nonce');
    remove_filter( 'nonce_life', 'noncelife' );

    return $created_nonce;
    }

With wp_localize_script i send the nonce to a jquery file enqueued in the plugin:

wp_localize_script( 'timcontact', 'ctfprocessajax', array('ajaxurl' => admin_url('admin-ajax.php'),
                                                      'formnonce' => custom_nonce_value() ) );

The ajax function in my jquery file sends all data via admin-ajax.php with the appropriate action name to wp_process_timform.php that contains the send e-mail function.

add_action( 'wp_ajax_toaformsendmail', 'timform_sendmail' );
add_action( 'wp_ajax_nopriv_toaformsendmail', 'timform_sendmail' );

function timform_sendmail() {
    if ($_SERVER["REQUEST_METHOD"] == "POST") {
        if (isset($_POST['nonce']) && !empty($_POST['nonce'])){
           $nonce = $_POST['nonce'];
           } else {
           $nonce = ''; 
           }

    if(! wp_verify_nonce( $nonce, 'timform_nonce' )){ //always false
       echo $nonce; //is identical but does not validate
       die( 'Security check' );
       } else {
       // Send the email.
    if (wp_mail($recipient, $subject, $message_send, $headers)) {
        // Set a 200 (okay) response code.
        http_response_code(200);
        echo "<p class=\"timform-okmessage\">Thanks etc.</p>";
    } else {
           // Set a 500 (internal server error) response code.
           http_response_code(500);
           echo "Error";
        }
        die();
        }
    }
}

The function works perfect without the wp_verify_nonce condition, but with wp_verify_nonce the condition always returns false. Why is this not validating when the nonces are identical? Is wp_verify_nonce not reachable via a plugin?

• plugin-development
• validation
• nonce

Share Improve this question edited Aug 28, 2024 at 20:19 gurky asked Aug 28, 2024 at 15:35 gurkygurky 5588 bronze badges 11

• Does it work without the filter to change the time limit? – Rup Commented Aug 28, 2024 at 15:46
• I’ll check that. Yes, it does. Thanks. But the time is too long. No way to make this work with shortening the life time of a nonce? – gurky Commented Aug 28, 2024 at 15:50

• 本文标签： plugin developmentwpverifynonce is always false even when the nonces are identical

  版权声明：本文标题：plugin development - wp_verify_nonce is always false even when the nonces are identical 内容由网友自发贡献，该文观点仅代表作者本人， 转载请联系作者并注明出处：http://www.betaflare.com/web/1736296478a1929806.html， 本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容，一经查实，本站将立刻删除。